Page |1
CONTRACT REVIEWS
Presented by Susan Kohlhausen
Director, Legal Affairs
Coastal Federal Credit Union
1. VENDOR ON-BOARDING PROCESS
A. RFP (Request for Proposal)
B. Due Diligence/Risk Assessment
C. Vendor Selection
D. Contract Review
E. Contract Negotiation
F. Contract Execution
G. Ongoing Vendor Administration/Oversight
NOTES: The Contract Review process is just a fraction of the entire vendor on-boarding process.
The Due Diligence (make the vendor show all their cards)/Risk Assessment (cost/benefit analysis) is critical
so that you identify the risks and benefits of each possible vendor to allow you to select the vendor that
is best aligned with your company’s mission, goals and policies.
EXAMPLE: Coastal spent more than 6 months evaluating various vendor software to replace a major
financial system. Unfortunately, Coastal was unable to contract with its first choice because the vendor’s
financial health did not meet Coastal’s standards.
2. POLICY: Does the company have a vendor selection policy? If so, be sure to follow it!
3. WHAT IS A CONTRACT? (Definition)
“A promise or a set of promises for the breach of which the law gives a remedy, or the performance of
which the law in some way recognizes as a duty.” - Restatement (Second) of Contracts
= LEGALLY ENFORCEABLE AGREEMENT
4. Purpose of Written Contracts
A. Performance: Documents expectations and obligations of the parties and products/services a
B. Protection: Provides remedies for the unexpected (i.e. breach)
NOTES: Why are contracts necessary? (i.e. no more “handshake” deals)
A. Act as a formal “roadmap to the relationship”
B. Contract survives the individuals negotiating the deal
© Susan Kohlhausen 2013 These general materials have been prepared for educational and information purposes only which may or may not
be correct, complete or current at the time or reading. The contents are not legal advice or legal opinions on any specific matters. Readers
should not act, or fail to act, upon this information without seeking professional counsel. No person should act or fail to act on any legal matter
based on the contents of this document. Coastal Federal Credit Union and Susan Kohlhausen expressly disclaim all liability relating to actions
taken or not taken based on any or all content herein.
Page |2
5. BASIC ASSUMPTIONS
A. You have READ the contract
B. You UNDERSTAND the terms of the contract
NOTES: Seems obvious but…. many companies have a long history of signing any/every contract put in
front of them without even reading it!
6. PERFORMANCE CLAUSES
A. Scope
B. Performance/Service Levels
C. Reports
D. Subcontracting/Third Parties
E. Duration
F. Fees
7. PROTECTION CLAUSES
A. Assignment
B. Right to Audit
C. Compliance
D. Intellectual Property Rights
E. Confidentiality and Security
F. Business Continuity/Contingency
G. Insurance
H. Warranties
I. Liability/Damages
J. Indemnification
K. Dispute Resolution
L. Modification/Waiver
M. Termination
8. Performance: Scope
A. Detailed description of product/services to be provided.
B. Specific obligations of all parties (including any subcontractors/third parties)
9. Performance: Service Levels (SLAs)
A. Usually included as an addendum/attachment to contract
B. Plain language documenting specific minimum service levels, standard maintenance periods,
response times for product (usually software) or service issues or failures, additional support (help
desk) needs and measurement periods. Examples include
i. Product/service will be fully functional not less than 98% per day/month/quarter
excluding standard maintenance periods
ii. Vendor shall commence review/analysis of all Severity 1 (non-function) issues within 4
hours of company’s written/verbal notification.
iii. Vendor will achieve and maintain a customer satisfaction rating of not less than 75%
each calendar quarter
© Susan Kohlhausen 2013 These general materials have been prepared for educational and information purposes only which may or may not
be correct, complete or current at the time or reading. The contents are not legal advice or legal opinions on any specific matters. Readers
should not act, or fail to act, upon this information without seeking professional counsel. No person should act or fail to act on any legal matter
based on the contents of this document. Coastal Federal Credit Union and Susan Kohlhausen expressly disclaim all liability relating to actions
taken or not taken based on any or all content herein.
Page |3
C. Recommend use of industry standards to develop service levels
D. Maintenance periods should be narrow and during customer’s off-peak hours
E. Include specific language addressing notification requirements (specific
personnel/communication channel (email/telephone)
F. Often requires vendor to self report issues/failures
G. Damages for failure to meet SLAs usually in form of a % credit of fees with right to terminate
for repeated failures within a certain measurement period or extreme failure to perform.
H. SLA terms are usually an exception/ stand-alone from general breach/right to cure language
10. Performance: Reports
A. Outline all reports needed from vendor.
B. Include type and frequency of reports needed (performance, security, business continuity, etc.)
and specific information to be included
C. Note any custom or external reports needed and related fees. (Watch for upcharges.
Recommend including “pass through cost” language.)
11. Performance: Subcontractors
A. Contract should specify whether parties are permitted to use subcontractors and the specific
obligations they will perform.
B. Who has right to approve, remove or replace contractor?
C. Who is liable for subcontractor? Minimum qualification/background requirements?
D. Be sure that subcontractor use language does not conflict with the assignment clause.
12. Performance: Duration
A. Length of contract should be commiserate with the type of product/service being provided and
within industry standards.
B. Be aware of auto-renewal (evergreen) clauses and termination notification requirements
C. Build in enough time between notice of termination and actual termination to find replacement
vendor (if needed).
D. Include minimum notification period for any fee increases to allow time to find and contract
with new (less costly) vendor prior to termination notification requirements. (i.e. Vendor should
provide notice of fee increase not less than 6 months prior to end of term where company is
required to give 90 days notice of termination.)
13. Performance: Fees
A. Fees: how calculated. (base payments, recurring services, activity charges, etc.)
B. Right to dispute fees without penalty
C. Responsibility for state and federal taxes
D. Cost for product maintenance/upgrades
E. Late payment penalties
F. Caution: Language permitting vendor or party the right to deduct from company accounts
without adequate controls.
G. Caution: Language permitting vendor the right to deduct fees/penalties from any income it
collects on behalf of company
H. Caution: Language requiring payment while in a force majeure situation.
© Susan Kohlhausen 2013 These general materials have been prepared for educational and information purposes only which may or may not
be correct, complete or current at the time or reading. The contents are not legal advice or legal opinions on any specific matters. Readers
should not act, or fail to act, upon this information without seeking professional counsel. No person should act or fail to act on any legal matter
based on the contents of this document. Coastal Federal Credit Union and Susan Kohlhausen expressly disclaim all liability relating to actions
taken or not taken based on any or all content herein.
Page |4
14. Protection: Assignment
A. Which parties (if any) have the right to delegate (in whole or part) its rights and obligations.
B. Prohibit assignment without consent. Usually includes language permitting assignment in case
of purchase or merger or in case or to an affiliate.
C. Watch: Without limiting language, possible to assign to a vendor that failed company due
diligence!
15. Protection: Right to Audit
A. Allows party (or third party agents) to audit company information/records to test internal
controls or prove compliance with contract terms.
B. Watch: Overly broad property/information access language. Recommend including language
limiting number of audits in a specific period without cause (i.e. not more than once annually),
audit schedule (i.e. during company’s normal business hours) and scope of audit.
C. Watch: Who pays for cost of audit? (Under-reporting penalties)
16. Protection: Compliance
A. Parties should agree to comply with all applicable laws (federal, state and local)
B. Vendor will provide assistance/access as needed to company’s government regulators.
17. Protection: Intellectual Property Rights
A. Ownership, rights to and permissible use of company data, equipment, software
B. Property rights should generally remain with the property owner or licensor except in cases
where there is work product specifically developed for another party.
C. Includes right to name, logos, trademarks, copyrights, domains, etc.
D. Ensure contract grants license to use, sublicense, etc. all products/services as needed.
18. Protection: Confidentiality and Security
A. Prohibit parties (and its agents/subcontractors) from disclosing or using certain company
information except as necessary to perform pursuant to the contract.
B. Return or destroy confidential information upon termination of contract or other designated
time.
C. Exceptions to CI
D. Adequate security within industry standards and not less than used to protect own CI
E. Require prompt notification and full disclosure of security breaches of CI or that will affect
company or its customers
F. Specify necessary corrective action (Damages: Credit Monitoring?)
G. Disclosure for court order or authorized government request
H. Watch: Include language where notification except where prohibited by law or court order
19. Protection: Business Continuity/Contingency
A. Back-up and protection plan in case of disaster or other extraordinary event that prevents use
of primary/standard systems.
B. Provide copy of plan. Updated and tested regularly. Provide results.
C. Include business recovery time frames and other metrics as needed
D. Consider interdependencies among all service providers
E. Watch: Overly broad “force majeure” clauses
© Susan Kohlhausen 2013 These general materials have been prepared for educational and information purposes only which may or may not
be correct, complete or current at the time or reading. The contents are not legal advice or legal opinions on any specific matters. Readers
should not act, or fail to act, upon this information without seeking professional counsel. No person should act or fail to act on any legal matter
based on the contents of this document. Coastal Federal Credit Union and Susan Kohlhausen expressly disclaim all liability relating to actions
taken or not taken based on any or all content herein.
Page |5
20. Protection: Insurance
A. Consider types and amounts (liability, E&O, crime/fidelity, worker’s compensation).
Minimums?
B. Additional insured or other endorsement
C. Notification of cancellation or material changes in coverage
21. Protection: Warranties
A. May include legal status of parties, authority to enter into agreement
B. Seek warranty of non-infringement for all intellectual property used or subject to the contract
C. Disclaimer of implied warranties (workmanlike quality, merchantability and fitness for a
particular purpose, title)
22. Protection: Liability/Damages
A. Generally limited to fixed amount, a service credit or a multiple of total amount paid for services
under agreement or other identified term (# of months, quarter, etc.)
B. Lost data: limited to correction/reconstruction
C. Exclusion of indirect/secondary damages (consequential, special, incidental)
D. RECOMMEND: Make any limits reciprocal
E. Assess whether damage limitation is commiserate with amount of loss (current and future) as
a result of breach of contract.
F. Exceptions/Carve-outs:
1. Gross vs ordinary negligence
2. Breach of confidentiality/security
3. Breach of warranties/representations
4. Violation of law
5. Death, bodily injury or physical damage to tangible personal property
23. Protection: Indemnification
A. Hold harmless from liability arising from breach of contract, negligence of the other party or
intellectual property infringement.
B. Include defend language? If so, include language for right to hire own attorney. If not, include
language that vendor will pay all (reasonable) attorney fees and associated costs.
C. Limit to third party claims
24. Protection: Dispute Resolution
A. Mediation/arbitration clauses
B. Ensure continuation of products/services during any dispute period
C. Losing party responsible for costs/fees
D. Reserve right to seek injunctive relief
25. Protection: Modification/Waiver
A. All contract modifications should be in writing and executed by all parties.
B. Be very cautious of carve-outs (right to increase fees or change terms (or even terminate
agreement) for change in law/regulation
© Susan Kohlhausen 2013 These general materials have been prepared for educational and information purposes only which may or may not
be correct, complete or current at the time or reading. The contents are not legal advice or legal opinions on any specific matters. Readers
should not act, or fail to act, upon this information without seeking professional counsel. No person should act or fail to act on any legal matter
based on the contents of this document. Coastal Federal Credit Union and Susan Kohlhausen expressly disclaim all liability relating to actions
taken or not taken based on any or all content herein.
Page |6
26. Protection: Termination
A. For convenience: Rare
B. For cause. Right to cure? Time period and measurement?
27. ADDITIONAL THOUGHTS:
A. AVOID or HANDLE WITH EXTREME CAUTION multi-party agreements unless absolutely
necessary. Complicated.
B. Also important to recognize what is MISSING from a contract.
C. Use a CHECKLIST: https://chapters.theiia.org/raleighdurham/Events/Documents/SAMPLE%20Contract%20Review%20Checklist.docx
D. CAPITALIZED TERMS should be defined!
E. Incorporate RFP responses into agreement if needed.
F. ATTORNEYS: Unless they specialize in contracts, then be cautious.
G. THROW AWAY TERMS: Be ready to give up some
H. AVOID: “In it’s sole discretion” language….
© Susan Kohlhausen 2013 These general materials have been prepared for educational and information purposes only which may or may not
be correct, complete or current at the time or reading. The contents are not legal advice or legal opinions on any specific matters. Readers
should not act, or fail to act, upon this information without seeking professional counsel. No person should act or fail to act on any legal matter
based on the contents of this document. Coastal Federal Credit Union and Susan Kohlhausen expressly disclaim all liability relating to actions
taken or not taken based on any or all content herein.